[mcp] Refused OAuth callback leaves MCP connection pending until 15-minute TTL

## Observed symptom A refused OAuth callback leaves the connection pending until the flow's 15-minute TTL **Type**: bug **File**: src/api/routes/mcp-auth.ts (`readCallbackParams`, the `error` branch) **Priority**: med **Found during**: #1431 **Description**: When the authorization server redirects back with `?error=` (for example `access_denied`, or `invalid_scope` once no scope fallback is left), the callback shows "Authorization failed" but never settles the pending flow in `oauth-flow-registry`. The connection stays in `pending_auth` ("Connecting…") until the 15-minute TTL rejects it, and a personal connector answers `ConnectorBusyError` (409) to a second Connect for that whole window. ## Literal error text ``` invalid_scope ``` ## Environment GitHub issue NimbleBrainInc/nimblebrain #1433; state=OPEN ## Trigger / context Public GitHub report in NimbleBrainInc/nimblebrain (FRESH_7D). ## Source evidence - https://github.com/NimbleBrainInc/nimblebrain/issues/1433 (2026-09-29T23:56:29Z) — evidence_class: PRIMARY_ISSUE_REPORT — GitHub issue #1433 (OPEN) ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T09:33:42Z - scout_id: Cf59a8d393a ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.